il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2026-AUG-29

Browse Source
This commit is contained in:
il
2026-08-29 20:31:53 +09:00
parent ea8dfc8c20
commit 9226043696
41 changed files with 426 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/archives/services/app/booklogr/authelia.yaml
+33
View File
@@ -0,0 +1,33 @@
identity_providers:
oidc:
cors:
# booklogr cors configuration
endpoints:
- 'authorization'
- 'token'
- 'userinfo'
allowed_origins:
- 'https://booklogr.example.com'
clients:
# https://booklogr.app/docs/Configuration/OIDC-sign-in
- client_id: 'booklogr'
client_name: 'booklogr'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://booklogr.example.com/callback'
scopes:
- 'openid'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_post'
docs/archives/services/app/booklogr/booklogr-api.container.j2
+51
View File
@@ -0,0 +1,51 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=BookLogr API
After=network-online.target
Wants=network-online.target
[Container]
Image=docker.io/mozzo/booklogr:{{ version['containers']['booklogr'] }}
ContainerName=booklogr-api
HostName=booklogr-api
PublishPort={{ services['booklogr']['ports']['api'] }}:5000/tcp
Volume=%h/data/containers/booklogr/profile_pictures:/app/profile_pictures:rw
Volume=%h/data/containers/booklogr/export_data:/app/export_data:rw
Volume=%h/containers/booklogr/ssl:/etc/ssl/booklogr:ro
# General
Environment="TZ={{ timezone }}"
Environment="SINGLE_USER_MODE=false"
Environment="EXPORT_FOLDER=/app/export_data"
# PostgreSQL
Environment="DATABASE_URL=postgresql://booklogr@{{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}/booklogr_db"
Environment="PGSSLMODE=verify-full"
Environment="PGSSLROOTCERT=/etc/ssl/booklogr/{{ root_cert_filename }}"
Secret=BOOKLOGR_POSTGRES_PASSWORD,type=env,target=PGPASSWORD
# Authentication
Environment="AUTH_ALLOW_REGISTRATION=true"
Environment="AUTH_REQUIRE_VERIFICATION=false"
Secret=BOOKLOGR_AUTH_SECRET_KEY,type=env,target=AUTH_SECRET_KEY
# OIDC - Authelia
Environment="OIDC_CLIENT_ID=booklogr"
Environment="OIDC_REDIRECT_URI=https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}/callback"
Environment="OIDC_DISCOVERY_URL=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/.well-known/openid-configuration"
Secret=BOOKLOGR_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
[Service]
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
docs/archives/services/app/booklogr/booklogr-web.container.j2
+42
View File
@@ -0,0 +1,42 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=BookLogr Web
After=network-online.target booklogr-api.service
Wants=network-online.target booklogr-api.service
[Container]
Image=docker.io/mozzo/booklogr-web:{{ version['containers']['booklogr'] }}
ContainerName=booklogr-web
HostName=booklogr-web
PublishPort={{ services['booklogr']['ports']['http'] }}:80/tcp
# General
Environment="TZ={{ timezone }}"
Environment="BL_DEMO_MODE=false"
Environment="BL_DEBUG=false"
Environment="BL_CHECK_UPDATES=true"
# API
Environment="BL_API_ENDPOINT=https://{{ services['booklogr']['domain']['public'] }}.{{ domain['public'] }}"
# Authentication UI
Environment="BL_SINGLE_USER_MODE=false"
Environment="BL_ALLOW_MANUAL_LOGIN=false"
Environment="BL_ALLOW_REGISTRATION=false"
# OIDC - Authelia
Environment="BL_OIDC_AUTHORITY=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}"
Environment="BL_OIDC_CLIENT_ID=booklogr"
[Service]
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
docs/archives/services/app/booklogr/group_vars.yaml
+17
View File
@@ -0,0 +1,17 @@
services:
booklogr:
domain:
public: "booklogr"
internal: "booklogr.app"
ports:
http: "5150"
api: "5000"
route:
api: "/v1 /v1/*"
deny: "/v1/login /v1/login/* /v1/register /v1/register/*"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
booklogr: "v1.11.1"
docs/archives/services/app/booklogr/secret.example.yaml
+8
View File
@@ -0,0 +1,8 @@
postgresql:
password:
booklogr: ""
booklogr:
secret_key: ""
oidc:
secret: ""
hash: ""
docs/archives/services/app/booklogr/set_booklogr.yaml
+110
View File
@@ -0,0 +1,110 @@
---
- name: Create booklogr directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/booklogr"
- "data/containers/booklogr/profile_pictures"
- "data/containers/booklogr/export_data"
- "containers/booklogr"
- "containers/booklogr/ssl"
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/booklogr/ssl/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0440"
notify: "notification_restart_booklogr"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "{{ item.name }}"
data: "{{ item.value }}"
state: "present"
force: true
loop:
- name: "BOOKLOGR_AUTH_SECRET_KEY"
value: "{{ hostvars['console']['booklogr']['secret_key'] }}"
- name: "BOOKLOGR_POSTGRES_PASSWORD"
value: "{{ hostvars['console']['postgresql']['password']['booklogr'] }}"
- name: "BOOKLOGR_OIDC_CLIENT_SECRET"
value: "{{ hostvars['console']['booklogr']['oidc']['secret'] }}"
notify: "notification_restart_booklogr"
no_log: true
- name: Pull image
containers.podman.podman_image:
name: "{{ item }}"
tag: "{{ version['containers']['booklogr'] }}"
state: "present"
pull: true
loop:
- "docker.io/mozzo/booklogr"
- "docker.io/mozzo/booklogr-web"
- name: Deploy booklogr.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/booklogr/{{ item }}.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/{{ item }}"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
loop:
- "booklogr-api.container"
- "booklogr-web.container"
notify: "notification_restart_booklogr"
- name: Enable booklogr.service
ansible.builtin.systemd:
name: "{{ item }}"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
loop:
- "booklogr-api.service"
- "booklogr-web.service"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
loop:
- name: "booklogr"
image: "docker.io/mozzo/booklogr:{{ version['containers']['booklogr'] }}"
file: "docker.io_mozzo_booklogr_{{ version['containers']['booklogr'] }}"
- name: "booklogr-web"
image: "docker.io/mozzo/booklogr-web:{{ version['containers']['booklogr'] }}"
file: "docker.io_mozzo_booklogr-web_{{ version['containers']['booklogr'] }}"
loop_control:
label: "{{ item.name }}"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "{{ item.item.image }}"
dest: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar"
format: "oci-archive"
force: false
loop: "{{ container_archive_images.results }}"
loop_control:
label: "{{ item.item.file }}"
when: not item.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
loop: "{{ container_archive_images.results }}"
loop_control:
label: "{{ item.item.file }}"
docs/archives/services/app/linkwarden/authelia.yaml
+35
View File
@@ -0,0 +1,35 @@
identity_providers:
oidc:
claims_policies:
linkwarden:
id_token:
- 'preferred_username'
- 'name'
- 'email'
- 'email_verified'
- 'groups'
clients:
# https://www.authelia.com/integration/openid-connect/clients/linkwarden/
- client_id: 'linkwarden'
claims_policy: 'linkwarden'
client_name: 'linkwarden'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://linkwarden.example.com/api/v1/auth/callback/oidc'
scopes:
- 'openid'
- 'groups'
- 'email'
- 'profile'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
docs/archives/services/app/linkwarden/group_vars.yaml
+13
View File
@@ -0,0 +1,13 @@
services:
linkwarden:
domain:
public: "link"
internal: "link.app"
ports:
http: "3005"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
linkwarden: "v2.16.1"
docs/archives/services/app/linkwarden/linkwarden.container.j2
+53
View File
@@ -0,0 +1,53 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=LinkWarden
[Container]
Image=ghcr.io/linkwarden/linkwarden:{{ version['containers']['linkwarden'] }}
ContainerName=linkwarden
HostName=linkwarden
PublishPort={{ services['linkwarden']['ports']['http'] }}:3000/tcp
# Volumes
Volume=%h/data/containers/linkwarden/data:/data/data:rw
Volume=%h/containers/linkwarden/ssl:/etc/ssl/linkwarden:ro
# General
Environment="TZ={{ timezone }}"
Environment="NEXTAUTH_URL=https://{{ services['linkwarden']['domain']['public'] }}.{{ domain['public'] }}/api/v1/auth"
Environment="ALLOW_PRIVATE_NETWORK_ACCESS=true"
Environment="ALLOW_INSECURE_TLS=false"
Secret=LINKWARDEN_SECRET_KEY,type=env,target=NEXTAUTH_SECRET
# Database (PostgreSQL)
# postgresql://linkwarden:PASSWORD@db.example.com:5432/linkwarden_db?sslmode=require&sslrootcert=/run/secrets/postgres-ca.crt&sslaccept=strict
Secret=LINKWARDEN_DATABASE_URL,type=env,target=DATABASE_URL
# OIDC
Environment="NEXT_PUBLIC_OIDC_ENABLED=true"
Environment="OIDC_CUSTOM_NAME=Authelia"
Environment="OIDC_WELLKNOWN_URL=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/.well-known/openid-configuration"
Environment="OIDC_CLIENT_ID=linkwarden"
Environment="OIDC_SCOPES=openid groups email profile"
Environment="NEXT_PUBLIC_DISABLE_REGISTRATION=true"
Environment="NEXT_PUBLIC_CREDENTIALS_ENABLED=false"
Environment="DISABLE_NEW_SSO_USERS=false"
Secret=LINKWARDEN_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
# Archiving
Environment="DISABLE_BROWSER=true"
Environment="NEXT_PUBLIC_MAX_FILE_BUFFER=250"
# Meili search
# Environment=MEILI_HOST=""
# Environment=MEILI_MASTER_KEY=""
[Service]
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
docs/archives/services/app/linkwarden/secrets.example.yaml
+8
View File
@@ -0,0 +1,8 @@
postgresql:
password:
linkwarden: ""
linkwarden:
secret_key: ""
oidc:
secret: ""
hash: ""
docs/archives/services/app/linkwarden/set_linkwarden.yaml
+87
View File
@@ -0,0 +1,87 @@
---
- name: Create linkwarden directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/linkwarden"
- "data/containers/linkwarden/data"
- "containers/linkwarden"
- "containers/linkwarden/ssl"
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/linkwarden/ssl/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_linkwarden"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "{{ item.name }}"
data: "{{ item.value }}"
state: "present"
force: true
loop:
- name: "LINKWARDEN_SECRET_KEY"
value: "{{ hostvars['console']['linkwarden']['secret_key'] }}"
- name: "LINKWARDEN_OIDC_CLIENT_SECRET"
value: "{{ hostvars['console']['linkwarden']['oidc']['secret'] }}"
- name: "LINKWARDEN_DATABASE_URL"
value: "postgresql://linkwarden:{{ hostvars['console']['postgresql']['password']['linkwarden'] | urlencode | replace('/', '%2F') }}\
@{{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}/linkwarden_db?sslmode=require&\
sslcert=/etc/ssl/linkwarden/{{ root_cert_filename }}&sslaccept=strict"
notify: "notification_restart_linkwarden"
no_log: true
- name: Pull image
containers.podman.podman_image:
name: "ghcr.io/linkwarden/linkwarden"
tag: "{{ version['containers']['linkwarden'] }}"
state: "present"
pull: true
- name: Deploy container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/linkwarden/linkwarden.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/linkwarden.container"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_linkwarden"
- name: Enable linkwarden.service
ansible.builtin.systemd:
name: "linkwarden.service"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/ghcr.io_linkwarden_linkwarden_{{ version['containers']['linkwarden'] }}.tar"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "ghcr.io/linkwarden/linkwarden:{{ version['containers']['linkwarden'] }}"
dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_linkwarden_linkwarden_{{ version['containers']['linkwarden'] }}.tar"
format: "oci-archive"
force: false
when: not container_archive_images.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/ghcr.io_linkwarden_linkwarden_{{ version['containers']['linkwarden'] }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
docs/archives/services/app/mealie/authelia.yaml
+26
View File
@@ -0,0 +1,26 @@
identity_providers:
oidc:
clients:
# https://www.authelia.com/integration/openid-connect/clients/mealie/
- client_id: 'mealie'
client_name: 'Mealie'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: true
pkce_challenge_method: 'S256'
redirect_uris:
- 'https://mealie.example.com/login'
scopes:
- 'openid'
- 'email'
- 'profile'
- 'groups'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
docs/archives/services/app/mealie/group_vars.yaml
+14
View File
@@ -0,0 +1,14 @@
services:
mealie:
domain:
public: "mealie"
internal: "mealie.app"
ports:
http: "9000"
subuid: "100910"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
mealie: "v3.22.0"
docs/archives/services/app/mealie/mealie.container.j2
+49
View File
@@ -0,0 +1,49 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=Mealie
[Container]
Image=ghcr.io/mealie-recipes/mealie:{{ version['containers']['mealie'] }}
ContainerName=mealie
HostName=mealie
PublishPort={{ services['mealie']['ports']['http'] }}:9000/tcp
# Volumes
Volume=%h/data/containers/mealie/data:/app/data:rw
Volume=%h/containers/mealie/ssl:/etc/ssl/mealie:ro
# General
Environment="TZ={{ timezone }}"
Environment="BASE_URL=https://{{ services['mealie']['domain']['public'] }}.{{ domain['public'] }}"
Environment="ALLOW_PASSWORD_LOGIN=false"
# Database (PostgreSQL)
Environment="DB_ENGINE=postgres"
Environment="POSTGRES_SERVER={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
Environment="POSTGRES_PORT={{ services['postgresql']['ports']['tcp'] }}"
Environment="POSTGRES_USER=mealie"
Environment="POSTGRES_DB=mealie_db"
Environment="PGSSLMODE=verify-full"
Environment="PGSSLROOTCERT=/etc/ssl/mealie/{{ root_cert_filename }}"
Secret=MEALIE_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD
# OIDC
Environment="OIDC_AUTH_ENABLED=true"
Environment="OIDC_SIGNUP_ENABLED=true"
Environment="OIDC_CONFIGURATION_URL=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/.well-known/openid-configuration"
Environment="OIDC_CLIENT_ID=mealie"
Environment="OIDC_AUTO_REDIRECT=false"
Environment="OIDC_ADMIN_GROUP=admins"
Environment="OIDC_USER_GROUP=users"
Secret=MEALIE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
[Service]
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
docs/archives/services/app/mealie/secret.example.yaml
+7
View File
@@ -0,0 +1,7 @@
postgresql:
password:
mealie: ""
mealie:
oidc:
secret: ""
hash: ""
docs/archives/services/app/mealie/set_mealie.yaml
+84
View File
@@ -0,0 +1,84 @@
---
- name: Create mealie directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['mealie']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/mealie"
- "data/containers/mealie/data"
- "containers/mealie"
- "containers/mealie/ssl"
become: true
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/mealie/ssl/{{ root_cert_filename }}"
owner: "{{ services['mealie']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0440"
become: true
notify: "notification_restart_mealie"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "{{ item.name }}"
data: "{{ item.value }}"
state: "present"
force: true
loop:
- name: "MEALIE_POSTGRES_PASSWORD"
value: "{{ hostvars['console']['postgresql']['password']['mealie'] }}"
- name: "MEALIE_OIDC_CLIENT_SECRET"
value: "{{ hostvars['console']['mealie']['oidc']['secret'] }}"
notify: "notification_restart_mealie"
no_log: true
- name: Pull image
containers.podman.podman_image:
name: "ghcr.io/mealie-recipes/mealie"
tag: "{{ version['containers']['mealie'] }}"
state: "present"
pull: true
- name: Deploy mealie.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/mealie/mealie.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/mealie.container"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_mealie"
- name: Enable mealie.service
ansible.builtin.systemd:
name: "mealie.service"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "ghcr.io/mealie-recipes/mealie:{{ version['containers']['mealie'] }}"
dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
format: "oci-archive"
force: false
when: not container_archive_images.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/ghcr.io_mealie-recipes_mealie_{{ version['containers']['mealie'] }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
docs/archives/services/app/romm/authelia.yaml
+36
View File
@@ -0,0 +1,36 @@
identity_providers:
oidc:
claims_policies:
romm:
id_token:
- 'email'
- 'email_verified'
- 'alt_emails'
- 'preferred_username'
- 'name'
- 'groups'
clients:
# https://www.authelia.com/integration/openid-connect/clients/romm/
- client_id: 'romm'
claims_policy: 'romm'
client_name: 'romm'
consent_mode: 'implicit'
client_secret: ''
public: false
authorization_policy: 'one_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://romm.example.com/api/oauth/openid'
scopes:
- 'openid'
- 'groups'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
docs/archives/services/app/romm/group_vars.yaml
+15
View File
@@ -0,0 +1,15 @@
services:
romm:
domain:
public: "romm"
internal: "romm.app"
ports:
http: "8002"
redis: "6384"
subuid: "100999"
dependency:
web: "app-public"
db: "postgresql"
version:
containers:
romm: "5.1.0"
docs/archives/services/app/romm/romm.container.j2
+80
View File
@@ -0,0 +1,80 @@
[Quadlet]
DefaultDependencies=false
[Unit]
Description=RomM
After=redis_romm.service
Wants=redis_romm.service
[Container]
Image=docker.io/rommapp/romm:{{ version['containers']['romm'] }}
ContainerName=romm
HostName=romm
PublishPort={{ services['romm']['ports']['http'] }}:8080/tcp
# Volumes
Volume=%h/data/containers/romm/library:/romm/library:rw
Volume=%h/data/containers/romm/resources:/romm/resources:rw
Volume=%h/data/containers/romm/assets:/romm/assets:rw
Volume=%h/containers/romm/ssl:/etc/ssl/romm:ro
# General
Environment="TZ={{ timezone }}"
Environment="ROMM_BASE_URL=https://{{ services['romm']['domain']['public'] }}.{{ domain['public'] }}"
Environment="DISABLE_SETUP_WIZARD=true"
Environment="DISABLE_USERPASS_LOGIN=true"
# Secrets
Secret=ROMM_AUTH_SECRET_KEY,type=env,target=ROMM_AUTH_SECRET_KEY
# Database
Environment="ROMM_DB_DRIVER=postgresql"
Environment="DB_HOST={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}"
Environment="DB_PORT={{ services['postgresql']['ports']['tcp'] }}"
Environment="DB_NAME=romm_db"
Environment="DB_USER=romm"
Environment="PGSSLMODE=verify-full"
Environment="PGSSLROOTCERT=/etc/ssl/romm/{{ root_cert_filename }}"
Secret=ROMM_DATABASE_PASSWORD,type=env,target=DB_PASSWD
# Redis
Environment="REDIS_HOST=host.containers.internal"
Environment="REDIS_PORT={{ services['romm']['ports']['redis'] }}"
# OIDC
Environment="OIDC_ENABLED=true"
Environment="OIDC_PROVIDER=authelia"
Environment="OIDC_CLIENT_ID=romm"
Environment="OIDC_REDIRECT_URI=https://{{ services['romm']['domain']['public'] }}.{{ domain['public'] }}/api/oauth/openid"
Environment="OIDC_SERVER_APPLICATION_URL=https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}"
Environment="OIDC_USERNAME_ATTRIBUTE=preferred_username"
Environment="OIDC_ALLOW_REGISTRATION=true"
Environment="OIDC_CLAIM_ROLES=groups"
Environment="OIDC_ROLE_ADMIN=admins"
Environment="OIDC_ROLE_VIEWER=users"
Environment="OIDC_AUTOLOGIN=false"
Secret=ROMM_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
# Players
Environment="DISABLE_EMULATOR_JS=false"
Environment="DISABLE_RUFFLE_RS=false"
# Metadata
Environment="HASHEOUS_API_ENABLED=true"
#Environment="PLAYMATCH_API_ENABLED=true"
# Optional
Environment="LOGLEVEL=INFO"
Environment="DISABLE_LOGS_VIEWER=true"
[Service]
ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
Restart=always
RestartSec=10s
TimeoutStopSec=120
[Install]
WantedBy=default.target
docs/archives/services/app/romm/secret.example.yaml
+8
View File
@@ -0,0 +1,8 @@
postgresql:
password:
romm: ""
romm:
secret_key: ""
oidc:
secret: ""
hash: ""
docs/archives/services/app/romm/set_romm.yaml
+146
View File
@@ -0,0 +1,146 @@
---
- name: Set redis service name
ansible.builtin.set_fact:
redis_service: "romm"
- name: Create redis_romm directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['redis']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "containers/redis"
- "containers/redis/{{ redis_service }}"
- "containers/redis/{{ redis_service }}/data"
become: true
- name: Deploy redis config file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_conf"
- name: Deploy redis container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
register: "is_redis_containerfile"
- name: Enable (Restart) redis service
ansible.builtin.systemd:
name: "redis_{{ redis_service }}.service"
state: "restarted"
enabled: true
daemon_reload: true
scope: "user"
when: is_redis_conf.changed or is_redis_containerfile.changed # noqa: no-handler
- name: Create romm directory
ansible.builtin.file:
path: "{{ node['home_path'] }}/{{ item }}"
state: "directory"
owner: "{{ services['romm']['subuid'] }}"
group: "{{ node['group'] }}"
mode: "0770"
loop:
- "data/containers/romm"
- "data/containers/romm/library"
- "data/containers/romm/resources"
- "data/containers/romm/assets"
- "containers/romm"
- "containers/romm/ssl"
become: true
- name: Deploy root certificate
ansible.builtin.copy:
content: |
{{ hostvars['console']['ca']['root']['crt'] }}
dest: "{{ node['home_path'] }}/containers/romm/ssl/{{ root_cert_filename }}"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0440"
notify: "notification_restart_romm"
no_log: true
- name: Register secret value to podman secret
containers.podman.podman_secret:
name: "{{ item.name }}"
data: "{{ item.value }}"
state: "present"
force: true
loop:
- name: "ROMM_AUTH_SECRET_KEY"
value: "{{ hostvars['console']['romm']['secret_key'] }}"
- name: "ROMM_DATABASE_PASSWORD"
value: "{{ hostvars['console']['postgresql']['password']['romm'] }}"
- name: "ROMM_OIDC_CLIENT_SECRET"
value: "{{ hostvars['console']['romm']['oidc']['secret'] }}"
notify: "notification_restart_romm"
no_log: true
- name: Pull image
containers.podman.podman_image:
name: "docker.io/rommapp/romm"
tag: "{{ version['containers']['romm'] }}"
state: "present"
pull: true
- name: Deploy romm.container file
ansible.builtin.template:
src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/romm/romm.container.j2"
dest: "{{ node['home_path'] }}/.config/containers/systemd/romm.container"
owner: "{{ ansible_user }}"
group: "{{ node['group'] }}"
mode: "0644"
notify: "notification_restart_romm"
- name: Enable romm.service
ansible.builtin.systemd:
name: "romm.service"
state: "started"
enabled: true
daemon_reload: true
scope: "user"
- name: Check container archive images
ansible.builtin.stat:
path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
loop:
- name: "redis"
image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
file: "docker.io_library_redis_{{ version['containers']['redis'] }}"
- name: "romm"
image: "docker.io/rommapp/romm:{{ version['containers']['romm'] }}"
file: "docker.io_rommapp_romm_{{ version['containers']['romm'] }}"
loop_control:
label: "{{ item.name }}"
register: container_archive_images
- name: Save container archive images
containers.podman.podman_save:
image:
- "{{ item.item.image }}"
dest: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar"
format: "oci-archive"
force: false
loop: "{{ container_archive_images.results }}"
loop_control:
label: "{{ item.item.file }}"
when: not item.stat.exists
- name: Fetch container archive images
ansible.builtin.fetch:
src: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar"
dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
flat: true
loop: "{{ container_archive_images.results }}"
loop_control:
label: "{{ item.item.file }}"